CVE-2021-28957 json
lxml vulnerable to Cross-Site Scripting
published 2021-03-21 5 y ago modified 2026-06-17 4 mo ago also GHSA-jq4v-f5q6-mjqq , PYSEC-2021-19 , EUVD-2021-0116
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.0%
- EPSS 4.0% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
Patch / fix
- pypi lxml 4.6.3
- lxml lxml 4.6.3
- lxml Debian 14, Debian 13, Debian 12 4.6.3-1
debian advisories DEBIAN-CVE-2021-28957
- lxml Ubuntu 16.04 LTS 3.5.0-1ubuntu0.4
- lxml Ubuntu 18.04 LTS 4.2.1-1ubuntu0.4
- lxml Ubuntu 20.04 LTS 4.5.0-1ubuntu0.3
- lxml Ubuntu Pro 14.04 LTS 3.3.3-1ubuntu0.2+esm3
ubuntu advisories UBUNTU-CVE-2021-28957
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- pytz RHEL 8 2019.3-3.module+el8.4.0+8888+89bc7e79
- babel RHEL 8 2.7.0-11.module+el8.5.0+11015+9c1c7c42
- numpy RHEL 8 1.17.3-6.module+el8.5.0+12205+a865257a
- scipy RHEL 8 1.3.1-4.module+el8.4.0+8888+89bc7e79
- Cython RHEL 8 0.29.14-4.module+el8.4.0+8888+89bc7e79
- pytest RHEL 8 4.6.6-3.module+el8.4.0+8888+89bc7e79
- PyYAML RHEL 8 5.4.1-1.module+el8.5.0+10721+14d8e0d5
- mod_wsgi RHEL 8 4.6.8-3.module+el8.4.0+8888+89bc7e79
red hat advisories RHSA-2021:4162RHSA-2021:4151RHSA-2021:3254RHSA-2021:4160RHSA-2021:4158
- python3-lxml SLES for SAP 12 SP5, SLES 12 SP5 3.6.1-3.6.1
- python3-lxml SLE Module for Public Cloud 12 3.3.5-3.15.1
- python-lxml openSUSE Leap 15.3 4.0.0-150000.4.3.1
- grafana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 6.7.4-3.26.1
- python-lxml OpenStack Cloud Crowbar 9, OpenStack Cloud 9 4.2.4-3.3.1
- python-Pillow OpenStack Cloud Crowbar 9, OpenStack Cloud 9 5.2.0-3.17.1
- ardana-barbican OpenStack Cloud 9 9.0+git.1644879908.8a641c1-3.13.1
- rubygem-sinatra OpenStack Cloud Crowbar 9 1.4.6-4.3.1
suse advisories SUSE-SU-2022:3937-1SUSE-SU-2022:3934-1SUSE-SU-2022:3836-1SUSE-SU-2022:1729-1SUSE-SU-2022:0895-1SUSE-SU-2022:0803-1
- translate-toolkit openSUSE Tumbleweed 3.14.5-1.1
- translate-toolkit openSUSE Tumbleweed 3.3.6-1.3
- python-lxml openSUSE Leap 15.3 4.7.1-3.7.1
opensuse advisories openSUSE-SU-2025:14647-1openSUSE-SU-2024:11473-1openSUSE-SU-2022:0803-1
- python38-py AlmaLinux 8 1.8.0-8.module_el8.6.0+2778+cd494b30
- python38-ply AlmaLinux 8 3.11-10.module_el8.6.0+2778+cd494b30
- python38-six AlmaLinux 8 1.12.0-10.module_el8.6.0+2778+cd494b30
- python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+2778+cd494b30
- python38-idna AlmaLinux 8 2.8-6.module_el8.6.0+2778+cd494b30
- python38-pytz AlmaLinux 8 2019.3-3.module_el8.6.0+2778+cd494b30
- python38-attrs AlmaLinux 8 19.3.0-3.module_el8.6.0+2778+cd494b30
- python38-babel AlmaLinux 8 2.7.0-11.module_el8.6.0+2778+cd494b30
almalinux advisories ALSA-2021:4162ALSA-2021:4160ALSA-2021:4158ALSA-2021:4151
- pytz Rocky Linux 8 2019.3-3.module+el8.4.0+570+c2eaf144
- babel Rocky Linux 8 2.7.0-11.module+el8.5.0+672+ab6eb015
- numpy Rocky Linux 8 1.17.3-6.module+el8.5.0+672+ab6eb015
- scipy Rocky Linux 8 1.3.1-4.module+el8.5.0+672+ab6eb015
- scipy Rocky Linux 8 1.3.1-4.module+el8.4.0+570+c2eaf144
- Cython Rocky Linux 8 0.29.14-4.module+el8.4.0+570+c2eaf144
- pytest Rocky Linux 8 4.6.6-3.module+el8.4.0+570+c2eaf144
- PyYAML Rocky Linux 8 5.4.1-1.module+el8.5.0+672+ab6eb015
rocky linux advisories RLSA-2021:4162RLSA-2021:4160RLSA-2021:4158RLSA-2021:4151
- py3-lxml Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 4.6.3-r0
alpine advisories ALPINE-CVE-2021-28957
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-lxml CBL-Mariner 2.0 4.8.0-1
azure linux advisories AZL-6808
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- python-lxml Arch Linux 4.6.3-1
arch linux advisories AVG-1720
- github.com/lxml/lxml#316 commit
- github.com/lxml/lxml@a5f9cb5 commit
- github.com/lxml/lxml@2d01a1b commit
- github.com/lxml/lxml#316 pull request
- oracle.com/security-alerts/cpuoct2021.html advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-28957 updated cvss 6.1
python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS
-
Red Hat Ansible Automation Platform 1.2 lxmlaffected: no fix available
-
Red Hat Ansible Tower 3 lxml Red Hat Enterprise Linux 6 python-lxml Red Hat Enterprise Linux 7 python-lxml Red Hat OpenStack Platform 10 (Newton) python-lxmlaffected: no fix planned “Out of support scope”
-
Red Hat OpenStack Platform 13 (Queens) python-lxmlaffected: no fix planned “Will not fix”
-
Red Hat CodeReady Linux Builder (v. 8) pytest 4.6.6-3.module+el8.4.0+8888+89bc7e79, pytest 6.0.2-2.module+el8.4.0+9822+20bf1249, Cython 0.29.21-5.module+el8.4.0+9822+20bf1249, pybind11 2.6.1-2.module+el8.4.0+9822+20bf1249, python-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python-py 1.10.0-1.module+el8.4.0+9822+20bf1249, +34 morefixed: vendor fix RHSA-2021:4162
-
Red Hat Enterprise Linux AppStream (v. 8) python-lxml 4.2.3-3.el8, python3-lxml 4.2.3-3.el8, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, scipy 1.3.1-4.module+el8.4.0+8888+89bc7e79, scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, pytz 2017.2-12.module+el8.1.0+3111+de3f2d8e, +205 morefixed: vendor fix RHSA-2021:4151
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, rh-python38-python-lxml 4.4.1-7.el7, rh-python38-python-pip 19.3.1-2.el7, rh-python38-python-idle 3.8.11-2.el7, rh-python38-python-libs 3.8.11-2.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, rh-python38-python-lxml 4.4.1-7.el7, rh-python38-python-pip 19.3.1-2.el7, rh-python38-python-idle 3.8.11-2.el7, rh-python38-python-libs 3.8.11-2.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, rh-python38-python-lxml 4.4.1-7.el7, rh-python38-python-pip 19.3.1-2.el7, rh-python38-python-idle 3.8.11-2.el7, rh-python38-python-libs 3.8.11-2.el7, +9 morefixed: vendor fix RHSA-2021:3254
-
Red Hat Enterprise Linux 9 python-lxml, python3-lxmlnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
4.04% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- bugs.launchpad.net https://bugs.launchpad.net/lxml/+bug/1888153 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | lxml | <4.6.3 |
4.6.3 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270
web, patch, third-party-advisory
-
github.com
/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory
-
github.com
/lxml/lxml/pull/316
web
-
github.com
/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
web
-
bugs.launchpad.net
/lxml/+bug/1888153
web, exploit, issue-tracking, third-party-advisory
-
debian.org
/security/2021/dsa-4880
vendor-advisory, web, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ/
vendor-advisory
-
security.gentoo.org
/glsa/202208-06
vendor-advisory, web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2021/03/msg00031.html
mailing-list, web, third-party-advisory
-
security.netapp.com
/advisory/ntap-20210521-0004/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-28957
advisory
-
security.netapp.com
/advisory/ntap-20210521-0004
web
-
pypi.org
/project/lxml
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45
web
-
github.com
/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-19.yaml
web
-
github.com
/lxml/lxml
package
-
github.com
/advisories/GHSA-jq4v-f5q6-mjqq
advisory
Sources
- CVE List CVE-2021-28957
- GitHub Advisory GHSA-jq4v-f5q6-mjqq
- NVD CVE-2021-28957
- OSV PYSEC-2021-19
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.